2e02e182663ce225f611c338fceed3407bb7ef4b88784a9ece4ab1b0fe187335

Analysis

max time kernel
99s
max time network
126s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29/10/2022, 04:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2e02e182663ce225f611c338fceed3407bb7ef4b88784a9ece4ab1b0fe187335.exe
Size

313KB
MD5

bdf01bba768d2cf4c09e1bb4375826ea
SHA1

73bcac9ccd8509d64c043ba116800702be37a7c9
SHA256

2e02e182663ce225f611c338fceed3407bb7ef4b88784a9ece4ab1b0fe187335
SHA512

e3551b03792d01deba5a9306f0a010fedcc5b6d3901890d81406602f32613785b9f844484fff20787b6ca5438adaadc6c310e41cf4a17fbb49b43c6836910aa7
SSDEEP

6144:5rkA9uEo2S1YnQmCX492DkwNP3qpYF0lu7tIYxFtApNhiYLE2/5yr3+LijYSF:5rk4u6/eIo4nlu7trxFtApfgMyrpjYSF

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
980	2e02e182663ce225f611c338fceed3407bb7ef4b88784a9ece4ab1b0fe187335.exe
980	2e02e182663ce225f611c338fceed3407bb7ef4b88784a9ece4ab1b0fe187335.exe
980	2e02e182663ce225f611c338fceed3407bb7ef4b88784a9ece4ab1b0fe187335.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	2e02e182663ce225f611c338fceed3407bb7ef4b88784a9ece4ab1b0fe187335.exe
Key value enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	2e02e182663ce225f611c338fceed3407bb7ef4b88784a9ece4ab1b0fe187335.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
980	2e02e182663ce225f611c338fceed3407bb7ef4b88784a9ece4ab1b0fe187335.exe

C:\Users\Admin\AppData\Local\Temp\2e02e182663ce225f611c338fceed3407bb7ef4b88784a9ece4ab1b0fe187335.exe
"C:\Users\Admin\AppData\Local\Temp\2e02e182663ce225f611c338fceed3407bb7ef4b88784a9ece4ab1b0fe187335.exe"
1⤵
- Loads dropped DLL
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
PID:980

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\Tsu6724D28A.dll

Filesize
180KB

MD5
02c9e35939f7779c639b52454fa00a3e

SHA1
d8c70bfdf8dd1465ab67d0df2aea912c3bd4a201

SHA256
9e333a658a10508e39e8d93147a4dd42dd39582a4af4394b62b377448db3babb

SHA512
709886442f03086ab9d5dcd80b6ad57c3e4cf5f919d2d972eead094578bde7081be2dc998f6e96f53c7f8a94590e6acafeff674796bfd7aa55acb885563bba67

Download Submit
\Users\Admin\AppData\Local\Temp\{BAD10E71-CD8A-482D-AAC6-85A861322C87}\Custom.dll

Filesize
91KB

MD5
ed92e425cd374788afede25d2dd9d84a

SHA1
666fcb0dc635af7ba075e48c8f8c72a16dd30a67

SHA256
a50e3750c29b54f7b304064bb843972dba4094ee9ceef4e6942c61d2a5690d46

SHA512
8afa88d37eaef17822c7fe9285f30d4766af63cabf0dea05b5e74b5a2cd5dfced7729418d42979a7ab006cda6a17731c59b93400c4f2be3f3b59e81e2800687d

Download Submit
\Users\Admin\AppData\Local\Temp\{BAD10E71-CD8A-482D-AAC6-85A861322C87}\_Setup.dll

Filesize
138KB

MD5
a40dff793fba6160e28295223004a727

SHA1
4b0f6571ceda3873f48ed26aa67b23ea6697b0a5

SHA256
448ac6f5ad1a68c349e7f0760c9ac0da021255c24ad8ba0eae993237b10174ed

SHA512
93cfb396861d8091f96bdd47724539f16f8a8b2e6725e268926b19ce400c667d71fb5a7bf0ab76cdd8dcedd004684c448b66e95dc0eca18ca447e773e7c522e2

Download Submit
memory/980-55-0x0000000075811000-0x0000000075813000-memory.dmp

Filesize
8KB

Download